Polymarket World Cup Player Goal Value

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:29 AM UTC
• Version: 0.1.6

Overview

This is a disclosed trading skill, but it can place real-money orders through a mutable third-party SDK that receives the API key.

Review this before installing if you intend to use live trading. Prefer a pinned, reviewed simmer-sdk version, use a narrowly scoped SIMMER_API_KEY, start with dry-run or sim mode, keep low budget caps, and only run --live when you are ready for real orders.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:8

Finding

Unbounded Third-Party SDK Version

Content

View full analysis

Vulnerability Details

File Location: clawhub.json:8
Vulnerability Type: Unbounded third-party dependency
Risk Level: Medium

Vulnerable Code

json

"pip": [
  "simmer-sdk>=0.17.1"
]

Technical Analysis

The dependency specification establishes only a minimum version and permits the installer to select any future release of simmer-sdk. The project does not include an exact version pin, upper bound, lock file, or package integrity hash.

This SDK is imported into the main process and receives the SIMMER_API_KEY. It also performs account queries and trading operations. Consequently, a compromised or malicious future SDK release would execute with the same filesystem, environment, and network privileges as the Skill.

The authenticated network behavior identified by the pre-scan is otherwise consistent with the declared functionality: player_goal_value.py and scripts/status.py send the API key as a bearer token only to the fixed HTTPS host api.simmer.markets. No evidence of transmission to an unrelated destination was found.

Attack Path

1. An attacker compromises the package publisher account, package repository, or SDK release process.
2. The attacker publishes a newer simmer-sdk version that still satisfies >=0.17.1.
3. A new installation or dependency update resolves to the compromised version.
4. player_goal_value.py imports and executes the compromised SDK in the Skill process.
5. Malicious package code reads SIMMER_API_KEY or other accessible environment data.
6. The code can exfiltrate credentials, alter API operations, or submit unauthorized trades using the Skill’s account authority.

Impact Assessment

Successful exploitation could expose the Simmer API credential and compromise the associated account. Because the SDK participates in market discovery, position queries, context retrieval, and order placement, malicious dependency code could manipulate trad ...[truncated 334 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the SDK to a reviewed exact version, for example:

  json

  "pip": [
    "simmer-sdk==0.17.1"
  ]
  

• Maintain a dependency lock file with cryptographic hashes and require hash verification during installation.
• Review SDK release notes and source changes before updating the pinned version.
• Use a narrowly scoped API key restricted to only the account and trading operations required by this Skill.
• Run the Skill in an isolated environment with minimal filesystem and network permissions.
• Add automated dependency vulnerability and provenance checks to the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tainted flow: 'req' from os.environ.get (line 143, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · player_goal_value.py (reported line 148)May include surrounding context.

python

headers={"Authorization": f"Bearer {key}", "Accept": "application/json"},
    )
    try:
        with urllib.request.urlopen(req, timeout=20) as r:
            data = json.loads(r.read().decode())
    except Exception:
        return []

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says the skill trades Polymarket player-goal YES markets using a scoring framework and patient limit orders. The supplied code does not trade, score markets, place orders, or interact with Polymarket at all. Its sole function is to retrieve player stats from Understat, aggregate them across seasons with recency weighting, and export a CSV. While such data collection could support a larger trading workflow, this chunk’s actual primary purpose is data ingestion/preprocessing, which is materially different from the declared trading behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for an automated trading skill focused on Polymarket player-goal YES markets and decision logic for placing patient limit orders. The supplied code does not trade at all. It is a read-only status utility for a different platform (Simmer), fetching portfolio and position data via authenticated API calls and printing summaries. This is a materially different primary purpose and accesses inconsistent resources relative to the declaration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script is materially out of scope for the declared Polymarket World Cup player-goal trading skill: it authenticates to and queries Simmer account APIs using a bearer token from the environment. This creates a dangerous scope mismatch because users may supply sensitive credentials or run unexpected account-access code under the assumption they are using a Polymarket-focused skill, increasing the risk of unauthorized data access and credential misuse.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents capabilities that imply filesystem, environment, and network access, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing least-privilege declarations can allow broader-than-necessary access and make it harder for operators to assess whether the skill may read secrets, modify files, or reach external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation includes a live trading command for Polymarket without a prominent warning that it can place real-money orders. In a trading skill, this is dangerous because users may copy-paste commands from the README and trigger irreversible financial actions without understanding the risk, especially when the same document also promotes dry-run and sim flows nearby.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata and thesis present the capability as Polymarket-specific, but the code allows execution on sim and Kalshi as well. Scope drift is dangerous in trading automation because venue semantics, order handling, and risk controls can differ, increasing the chance of unintended live orders or use outside the reviewed trust boundary.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · player_goal_value.py (reported line 142)May include surrounding context.

python

"limit": max(1, min(limit, 1000)),
        }
    )
    url = f"https://api.simmer.markets/api/sdk/markets?{params}"
    req = urllib.request.Request(
        url,
        headers={"Authorization": f"Bearer {key}", "Accept": "application/json"},

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is advertised as a World Cup player-goal trader, but market selection and expected-match logic cover season, generic match, league, and tournament markets broadly. In an automated live-trading context, this mismatch can cause the agent to trade materially different products than an operator expects, undermining review assumptions and increasing financial and operational risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

When --live is supplied, the skill can immediately place real orders without a final interactive confirmation or equivalent transaction-arming control. In a trading skill, this is security-relevant because accidental invocation, misconfiguration, or malicious orchestration by another agent can directly trigger financial loss.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module documentation advertises 'Simmer Account Status' behavior, which directly contradicts the declared skill purpose of trading Polymarket World Cup player-goal markets. Misleading documentation in an agent skill is security-relevant because it obscures true behavior, makes review harder, and can trick operators into authorizing execution with the wrong trust assumptions or credentials.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · player_goal_value.py (reported line 454)May include surrounding context.

python

for attr in ("yes_ask", "ask_yes", "best_ask_yes", "ask", "best_ask"):
        try:
            v = getattr(market_obj, attr, None)
            if v is not None:
                fv = float(v)
                if 0.0 < fv < 1.0:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · player_goal_value.py (reported line 479)May include surrounding context.

python

for attr in ("yes_ask", "ask_yes", "best_ask_yes", "ask", "best_ask"):
        try:
            v = getattr(market_obj, attr, None)
            if v is not None:
                fv = float(v)
                if 0.0 < fv < 1.0: